TL;DR: APT29 is one of the most-documented names in cybersecurity and one of the least useful to a reader, because the same crew answers to at least five labels: APT29, NOBELIUM, Cozy Bear, UNC2452 and, in Microsoft's current naming scheme, Midnight Blizzard.[1] The federal advisory with the clearest attribution says the UK National Cyber Security Centre and its international partners "assess that APT29 is a cyber espionage group, almost certainly part of the SVR," and lists the other names as "Midnight Blizzard, the Dukes, or Cozy Bear."[3] The pattern of the last few years is a steady move away from exploiting servers and toward stealing logins, with one federal advisory documenting the shift and Microsoft documenting what it looks like from the inside.[3][4] The newest chapter is the strangest. Since early May 2026, Microsoft has observed a sub-cluster of this actor running what it calls CaptiveCrunch: a campaign that rewrites DNS and HTTP traffic on the captive portals in hotels, conference centres and other shared venues, redirects browsers into phishing infrastructure and drops malware.[2] One of the payloads is an in-memory PowerShell infostealer that Microsoft says takes browser session cookies, saved browser passwords, Microsoft 365 single-sign-on tokens and Wi-Fi credentials.[2] Microsoft's guidance to travelers is blunt: "When traveling, users should treat hotel, conference, airport, and other guest wireless networks as untrustworthy."[2] Two earlier chapters explain how the actor gets in. In December 2023, the FBI, CISA, NSA and partner agencies said Russian SVR actors mass-exploited unpatched JetBrains TeamCity servers, hitting "a few dozen compromised companies in the United States, Europe, Asia, and Australia."[5] In January 2024, Microsoft said a password spray against a legacy test account let the actor register its own OAuth applications and read corporate mail.[4] The most recent dated item behind this page is Microsoft's threat-actor naming reference, updated October 22, 2026.[1]
Five Names, One Crew, and One Common Mistake
Start with the naming, because getting it wrong is how readers end up mixing up two different Russian intelligence agencies. Microsoft runs a weather-based naming taxonomy, and it explains the logic plainly: "For nation-state actors, a family name is assigned to a country/region of origin tied to attribution. For example, Typhoon indicates origin or attribution to China."[1] Russia gets the Blizzard family. That is why the page carries a column of Russian actors: Aqua Blizzard, Cadet Blizzard, Forest Blizzard, Frontier Blizzard, Ghost Blizzard, Midnight Blizzard, Secret Blizzard, Seashell Blizzard, Star Blizzard, Sunglow Blizzard and Void Blizzard, among others.[1]
The rule that trips people up is that a Blender-family name does not mean every Blizzard is the same actor. On Microsoft's own table, Midnight Blizzard is listed with the aliases "NOBELIUM, COZY BEAR, UNC2452, APT29", while Forest Blizzard sits in a completely different row with "STRONTIUM, FANCY BEAR, Sednit, ATG2, Sofacy, Blue Athena, Z-Lom Team, Operation Pawn Storm, Tsar Team, CrisisFour, HELLFIRE, APT28".[1] Fancy Bear is APT28. Cozy Bear is APT29, the group the federal advisories tie to the SVR. Conflating the two is common enough that Microsoft's page keeps both rows on the same screen, and this page keeps both in front of you for the same reason.
The other half of the naming system is the one Microsoft reserves for groups it has not yet fully identified. "For groups in development, a temporary designation of Storm and a four-digit number is used where there's a newly discovered, unknown, emerging, or developing cluster of threat activity."[1] That designation is temporary by design, and the page says what happens next: "Once criteria are met, a group in development is converted to a named actor or merged into existing names."[1]
Two Storm numbers matter for this story. Storm-2372 is, in Microsoft's words, "a Midnight Blizzard initial access operations sub-cluster," and Storm-2945 is "an operational sub-cluster of Midnight Blizzard."[2] Both are how the 2026 hotel Wi-Fi campaign is tracked, and both sit under the same parent actor. The other Storm numbers on Microsoft's list belong to financially motivated actors, to groups still under development, or to other state actors entirely.
What the Actor Is Actually After
This is espionage, not noise. Microsoft's own description of the group is short and blunt: "Their focus is to collect intelligence through longstanding and dedicated espionage of foreign interests."[4] When Microsoft detected the intrusion into its own systems on January 12, 2024, the company said the same thing in its first line about the investigation: "The Microsoft Threat Intelligence investigation identified the threat actor as Midnight Blizzard."[4]
The February 2024 joint advisory from CISA, NSA, FBI and partner agencies lays out the target list, and it is worth reading as a list of what to protect rather than a list of what to worry about. Previously targeted: government, think tanks, healthcare and energy. Newly added to that list: "aviation, education, law enforcement, local and state councils, government financial departments, and military organizations."[3] The advisory's framing of what counts as success is worth repeating, because it explains why a breach can look quiet: the goal is long-term access and collection, not disruption.
Microsoft's naming page describes the general pattern across nation-state actors, and it matches this actor's behaviour: "Microsoft observed that most nation state actors continue to focus operations and attacks on government agencies, intergovernmental organizations, nongovernmental organizations, and think tanks for traditional espionage or surveillance objectives."[1]
The 2026 Hotel Wi-Fi Campaign
Here is the part that should make you cancel your hotel Wi-Fi. Since early May 2026, Microsoft has observed Storm-2945 running what it calls CaptiveCrunch against hospitality networks: "widespread but targeted traffic manipulation attacks" on hotels, conference centres and other shared venues across "several countries."[2] The mechanism is the captive portal, the box you click through to get online. The actor compromises the portal, then rewrites the DNS and HTTP traffic that flows through it, so that the connectivity checks your laptop makes when it joins the network return answers the attacker controls. Your browser is redirected into phishing infrastructure, and the malware comes down through a lure the portal asks you to click.
The lure is a ClickFix pattern, which is a fake human-verification or fake update prompt that asks you to paste and run a command. Microsoft describes it as a technique that the actor's infrastructure uses to "elicit the user into downloading and executing the malware."[2] This is the part that catches people out. Nothing is being pushed to your machine automatically. The malware arrives because a portal you already trust told you to install something, and you did what the portal said.
ReliaQuest, quoted by Microsoft, assesses the goal of the campaign as "to access the accounts of corporate travelers."[2] Microsoft also notes that the equipment and management systems behind affected captive portals appear to have something in common, which raises the possibility that the compromise reaches shared captive-portal services rather than stopping at individual venues.[2] Microsoft published no victim count and no infection count for this campaign, and this page does not invent one.
The Remote Access Tool
The main implant is called CornFlake, and Microsoft describes it as "a full-featured Windows RAT written in Go."[2] It is a Go binary, which matters for one practical reason: cross-platform, statically linked, and simple to ship without a compiler on the target. It copies itself into a fake system directory, registers itself as a Windows service that displays as "Cloud Sync Service," and installs a layered set of persistence including a registry run key, a scheduled task and a watchdog that restores the persistence if it is removed.[2]
The collection capability is the reason it matters to a normal person. CornFlake captures raw keyboard input, which means it sees password fields as you type them. It monitors the clipboard. It takes screenshots on an idle trigger or on demand. It records from the microphone through WASAPI and saves the audio as WAV files, and it records from the webcam through Media Foundation, saving video as JPEG.[2] It watches removable media and scans it. It harvests a range of system information, which Microsoft lists as eighteen categories, including installed software, security software configuration, Defender exclusions, Remote Desktop history and credential hints.[2] For file theft, it collects by extension with real-time monitoring, and Microsoft says each cycle is limited to "1,000 files or 500 MB."[2] And it gives the operator a remote shell through cmd.exe or PowerShell.[2]
The Infostealer
The second payload is the one that turns a compromised laptop into a broken account everywhere else. ChocoShell is a PowerShell infostealer "delivered and executed entirely in-memory," which means nothing is written to disk to be found later by a file scan.[2] Its targets are exactly the things you would have to change to stop an attacker from using your accounts:
- Browser session cookies.
- Saved browser passwords.
- Microsoft 365 single-sign-on tokens.
- Wi-Fi credentials.
Microsoft describes how it gets them. On Chromium browsers it extracts the local state key so it can decrypt saved passwords, supports both the newer application-bound encryption and the older DPAPI path, and then launches Chrome, Edge and Brave with a remote debugging flag so that the browser hands over cookies in plain text through its debugging protocol.[2] For Mozilla-family browsers it copies the unencrypted cookie database, and Microsoft lists Firefox, Waterfox, LibreWolf, Floorp and Zen as targets.[2] For Microsoft 365 and Entra ID it takes access tokens, refresh tokens and cached token-broker files.[2] And for Wi-Fi it runs the Windows networking command with the clear-text key flag to pull saved network passwords.[2]
It also handles the boring half of the problem: elevation. Microsoft documents three silent User Account Control bypasses, falling back to a visible elevation prompt if all three fail, plus anti-analysis timing checks, and it notes the script disables antimalware scanning through reflection and contains developer comments and references to Microsoft detections that suggest the code was written with AI assistance.[2] Microsoft says the campaign used AI for "a significant portion of these operations."[2]
The Control Panel
The operator interface is FruitStone, a web application that Microsoft says was exposed without authentication, which is how the researchers got into it. It shows connected agents, gives the operator a shell, a file browser, and the ability to take screenshots, pull the clipboard, keylog, capture camera and audio, change configuration, update the implant in place and push new payloads. It also has proxy relays, beacon profiles and staging servers, TLS certificate tracking, and a sleep-and-reconnect timer with server name spoofing, Microsoft says, using names like "teams.microsoft.com."[2] The panel brands itself "CloudSync Console."[2]
The Credential Theft That Needs No Malware
Since July 16, 2026, Microsoft has also seen the campaign redirect users into Microsoft device-code authentication. The victim is told to enter a code that the actor generated on a legitimate Microsoft sign-in page, and the result is that the victim authenticates the attacker's session instead of their own.[2] Microsoft is careful about how it describes this: the technique is not new, but combined with captive-portal traffic manipulation it may look more legitimate than it is.[2] Nothing has to run on your machine for the token to be issued.
The Indicators
Microsoft published the indicators for this campaign, and they are the most useful thing on this page if you want to check your own machine. The table below reproduces the indicator list from Microsoft's write-up of CaptiveCrunch.[2]
| Indicator | What Microsoft says it is | First seen |
|---|---|---|
| cdn-gstat[.]com | CaptiveCrunch redirect | September 30, 2026 |
| sslcdnhost[.]com | CaptiveCrunch redirect | September 30, 2026 |
| network-privacy[.]com | CaptiveCrunch redirect | October 1, 2026 |
| ms365-device[.]com | CaptiveCrunch device-code redirect | July 23, 2026 |
| ms365-live[.]com | CaptiveCrunch device-code redirect | May 14, 2026 |
| m365-owa[.]com | CaptiveCrunch adversary-in-the-middle infrastructure | July 20, 2026 |
| owa-ms365[.]com | CaptiveCrunch adversary-in-the-middle infrastructure | July 16, 2026 |
| 154.29.75[.]245 | CaptiveCrunch infrastructure | September 29, 2026 |
| 149.3.170[.]186 | CaptiveCrunch device-code infrastructure | October 1, 2026 |
| 31.57.243[.]154 | CaptiveCrunch adversary-in-the-middle infrastructure | July 16, 2026 |
| 38.146.28[.]75 | CaptiveCrunch adversary-in-the-middle infrastructure | July 1, 2026 |
| 38.146.28[.]132 | CaptiveCrunch DNS resolver | July 15, 2026 |
| 104.194.159[.]150 | CaptiveCrunch adversary-in-the-middle infrastructure | April 28, 2026 |
| 107.189.26[.]194 | ChocoShell command and control, CaptiveCrunch DNS resolver | February 27, 2026 |
| 213.145.86[.]112 | ChocoShell command and control | July 1, 2026 |
Microsoft also gave a Defender for Endpoint alert name to watch for: "Suspicious activity linked to a Russian state-sponsored threat actor has been detected."[2] Microsoft warns that unrelated actors can trigger it too.[2] The detection names the vendor published include "Possible theft of passwords and other sensitive web browser information," "Possible Antimalware Scan Interface (AMSI) tampering," "Anomalous OAuth device code authentication activity," "Activity that might lead to information stealer," and "Possible Component Object Model (COM) hijacking."[2]
The Cloud Attack: Corporate Mail, January 2024
The hotel Wi-Fi campaign is new, but the way the actor gets into a cloud account is not. Microsoft published the whole chain of custody for its own breach in January 2024, and the chain starts with something almost too ordinary to be interesting. The entry point was a password spray against a legacy, non-production test account that had no multi-factor authentication. The actor tried a few likely passwords against a small number of accounts, with few attempts per account, and used distributed residential proxies to avoid triggering account blocks.[4]
Once inside, the actor found a legacy test OAuth application with elevated access. It created additional malicious OAuth applications and a new user account, used the new account to consent to the attacker-controlled applications, and then used the legacy test application to grant those applications the Office 365 Exchange Online role called full_access_as_app. The applications authenticated to Exchange Online and collected mail through the Exchange Web Services API.[4]
Two details deserve attention. First, no passwords were stolen in this phase, so any system watching for credential reuse or infostealer activity saw nothing. Second, Microsoft gave no number. The company said it had notified other organizations and that it was notifying them too, but it published no count of affected tenants and no count of affected mailboxes, and this page will not invent one.[4]
Microsoft's detection write-up is worth reading for the technique rather than the case. It notes that traditional IP indicators were insufficient, because the residential proxies rotated addresses too quickly, and it recommends behaviour-based detection instead: unfamiliar sign-in properties, password spray, suspicious workload-identity sign-ins, unusual OAuth and EWS activity, and users creating applications that access mailboxes.[4] Microsoft describes the method that worked as "reviewing Exchange Web Services (EWS) activity, combined with our extensive knowledge of Midnight Blizzard."[4]
How the SVR Gets Into Cloud Accounts Now
The February 2024 joint advisory is the clearest statement of the current approach, and its first line is the whole point: "To access the majority of the victims' cloud hosted network, actors must first successfully authenticate to the cloud provider."[3] That is a change of technique, not of intent. Instead of exploiting an internet-facing server and hoping the traffic routes through it, the actor authenticates.
The advisory lists the methods it has observed: password spraying and brute force against service accounts, use of dormant accounts belonging to former employees, reauthentication of inactive accounts after a password reset, theft and use of access tokens without passwords, password spraying and credential reuse on personal accounts, MFA fatigue, also called "MFA bombing," and registration of attacker-controlled devices in the cloud tenant.[3]
Two of those deserve a note. Reanimating a dormant account after a reset is a good argument for actually disabling leavers rather than just resetting their password. And registering a device in the tenant is the cloud equivalent of the legacy test application problem above: a device enrollment that nobody approved is a permanent key to everything the identity can reach.
Once authenticated, the advisory says the actor "is capable of deploying highly sophisticated post compromise capabilities such as MagicWeb," and it links to Microsoft's own 2022 reporting on MagicWeb.[3] The advisory also describes the actor using residential proxies, which blend malicious connections into "expected IP address pools in access logs."[3] That is why the detection advice leans on behaviour rather than addresses, and why Microsoft recommends combining application events with host-based logs instead of relying primarily on suspicious IP addresses.[3]
The Opportunistic Wave: JetBrains TeamCity, December 2023
The TeamCity exploitation is the part of the record that best illustrates how this actor behaves when it is not targeting. The FBI, CISA, NSA, Poland's SKW and CERT Polska, and the UK's NCSC published joint advisory AA23-347A on December 13, 2023, stating that they assess Russian Foreign Intelligence Service (SVR) cyber actors "also known as Advanced Persistent Threat 29 (APT 29), the Dukes, CozyBear, and NOBELIUM/Midnight Blizzard."[5]
The vector was CVE-2023-42793 in JetBrains TeamCity, patched in mid-September 2023.[5] Exploitation began "in late September 2023" against internet-facing servers. The flaw "enables the insecure handling of specific paths allowing for bypassing authorization, resulting in arbitrary code execution on the server," and typically produced code execution with high privileges.[5] The agencies said they were aware of "a few dozen compromised companies in the United States, Europe, Asia, and Australia, and are aware of over a hundred compromised devices though we assess this list does not represent the full set of compromised organizations."[5]
The framing matters more than the count. The agencies said the exploitation "was opportunistic in nature and not necessarily a targeted attack," and that the victims shared one trait: "an unpatched, Internet-reachable JetBrains TeamCity server."[5] The list included an energy trade association, plus software companies in billing, medical devices, customer care, employee monitoring, financial management, marketing, sales and video games, along with hosting companies and IT firms of every size.[5] One unpatched build server in an employee-monitoring software company and one in a medical device company were in scope. The espionage logic wrote itself.
After access, the actors escalated with privilege escalation tools, moved laterally using Windows Management Instrumentation, installed scheduled tasks and forged Kerberos tickets, and stole the SAM, SYSTEM and SECURITY registry hives along with SQL Server and Visual Studio files. They disabled endpoint protection software. They hid backdoors by hijacking DLL loading for Zabbix and Webroot, and by trojanizing the vcperf binary.[5]
The command and control was worth noting for its own sake. The advisory documents a tool called GraphicalProton that hides data inside image files, encoding it through a five-step process that ends with the instruction to "encode encrypted data within lower pixel bits."[5] The images were parked in OneDrive and Dropbox, so the traffic to Microsoft and to Google looked like file syncing. The command channel for the HTTPS variant was a re-registered expired domain running a dummy WordPress site.[5] A reader who assumes an espionage implant announces itself is not thinking about espionage implants.
The advisory's advice was blunt for organizations that had not patched: assume compromise and start hunting. For everyone else, the durable lessons are to patch internet-facing servers promptly, require multi-factor authentication "for all services to the extent possible," keep systems and firmware current, audit log files for privileged certificate access and fake identity providers, and configure authentication to confirm user activity and new device registration.[5]
The Federal Record Over Time
CISA maintains a single index of advisories about Russian state-sponsored cyber actors. The table below reproduces the entries in that index that fall inside this page's window, in date order, with a note on which of them speak about the SVR or APT29 specifically.[6] The index is worth reading in full, because the titles alone tell you how the target list has widened: government targets in 2020, network defenders in 2021, a CI software supply chain in 2023, cloud authentication in 2024, military logistics in 2025, and by 2026 the guidance has moved to router hygiene and phishing campaigns against Zimbra users.[6]
| Date | Advisory | Title | Names the SVR or APT29 |
|---|---|---|---|
| October 22, 2020 | AA20-296A | Joint FBI-CISA CSA: Russian State-Sponsored Advanced Persistent Threat Actor Compromises U.S. Government Targets | No |
| December 17, 2020 | AA20-352A | CISA Alert: Advanced Persistent Threat Compromise of Government Agencies, Critical Infrastructure, and Private Sector Organizations | No |
| April 26, 2021 | AA21-116A | Joint FBI-DHS-CISA CSA: SVR Cyber Operations: Trends and Best Practices for Network Defenders | Yes |
| December 13, 2023 | AA23-347A | Russian Foreign Intelligence Service (SVR) Exploiting JetBrains TeamCity CVE Globally | Yes |
| February 26, 2024 | AA24-057A | SVR Cyber Actors Adapt Tactics for Initial Cloud Access | Yes |
| September 5, 2024 | AA24-249A | Russian Military Cyber Actors Target US and Global Critical Infrastructure | No |
| May 21, 2025 | AA25-141A | Russian GRU Targeting Western Logistics Entities and Technology Companies | No |
| July 13, 2026 | AA26-194A | Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting | No |
| July 23, 2026 | AA26-204A | Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite | No |
Three of the nine advisories in that table name the SVR or APT29 directly. The rest describe Russian state activity more broadly, and two of them, AA24-249A and AA25-141A, are about other Russian state actors rather than the SVR: one on military cyber actors, one on the GRU.[6] Confusing those two families is the single most common error in coverage of Russian state hacking, and Microsoft's naming page is the cleanest way to avoid it.
What You Can Actually Do
Most of this actor's tradecraft needs either a server you did not patch or a person who clicked something. That is good news. Here is the checklist, with the source for each item.
On hotel and airport Wi-Fi, assume the portal can lie to you. Microsoft says it plainly: "When traveling, users should treat hotel, conference, airport, and other guest wireless networks as untrustworthy."[2]
Do not install anything a captive portal asks you to install. Microsoft's guidance is specific: "Avoid downloading software updates, certificates, browser updates, network troubleshooting tools, or security utilities" that appear in captive portals or unexpected prompts.[2] A portal asking you to install a certificate or a "network helper" is the whole attack.
Update through the operating system, not through a pop-up. Microsoft: "Verify update requests through trusted operating system mechanisms rather than pop-up messages or website prompts."[2]
Use your own connection when you can. Microsoft recommends preferring private connectivity over public Wi-Fi whenever practical, and suggests an enterprise-managed travel router or hotspot device that tunnels traffic to infrastructure you trust.[2] If you travel for work, a hotspot on your own phone is the cheapest version of this.
Do not reuse a work account on the portal registration page. Microsoft's guidance to corporate travelers is to avoid reusing corporate credentials on guest network registration pages, to minimize disclosure of employee identities and travel details, and to use passkeys and multi-factor authentication with conditional access and sign-in risk policies.[2] It also says to block the device-code flow where possible, which is the one piece of the 2026 campaign you can close off directly.[2]
Check the indicators on this page if you were on a captive portal since May 2026. Microsoft published the domains and addresses listed above, and they are the fastest way to check whether your machine talked to this campaign.[2]
For organizations: audit your OAuth applications. Microsoft's advice from the 2024 incident is to "Audit the current privilege level of all identities, users, service principals," to remove applications that are no longer required, and to restrict mailbox access through Exchange Online role-based access control so that applications are only granted access to the mailboxes they actually need.[4] If you inherited an app with mail permissions and nobody knows who owns it, that is the finding.
For organizations: reset the sprayed accounts and watch device registrations. Microsoft advises resetting account passwords for any account targeted in a password spray, and the February 2024 advisory adds short session lifetimes, canary service accounts, restricting device enrollment to authorized devices, and phishing-resistant multi-factor authentication.[3][4]
For organizations: patch internet-facing servers and hunt. If you ran an unpatched, internet-reachable TeamCity server, the advisory's instruction is to assume compromise and initiate threat hunting.[5]
If you are an individual rather than an organization, most of the second half does not apply, and pretending otherwise would be dishonest. What applies to you is narrow but real: treat the portal as untrusted, refuse the install prompt, use a hotspot, and if you clicked through, change your email password, revoke your sessions and check for the indicators above. The bigger lesson is that the actor goes after people through their employers, and the value of your email to an adversary rises sharply with your role.
The Honest Takeaway
The pattern across six years of federal advisories and vendor research is that the actor stopped needing exploits. In 2023 it mass-exploited unpatched TeamCity servers, and the agencies described the exploitation as opportunistic rather than targeted.[5] By 2024 it was authenticating: password spraying, token theft, dormant accounts and device registration into cloud tenants.[3][5] By 2026 it was standing on the network you already joined, rewriting what your laptop asks for and what your browser downloads.[2]
What the record does not contain is as important as what it does. Microsoft published no victim or infection count for CaptiveCrunch.[2] It published no count of affected tenants or mailboxes for the 2024 Microsoft 365 intrusion.[4] The agencies behind the TeamCity advisory said their own list "does not represent the full set of compromised organizations."[5] And none of the documents behind this page charges anyone with a crime: every description of this actor's work here is a vendor's assessment or a government's assessment, not a courtroom's finding.
This page is built from six documents. The most recent dated item among them is Microsoft's threat-actor naming reference, updated October 22, 2026, and the most recent operational document is Microsoft's July 31, 2026 write-up of CaptiveCrunch, which carries an update dated October 5, 2026.[1][2] Where the record is silent, this page is silent.
One last thing about the name. If you only remember one line from all of this, remember that Cozy Bear is APT29 and Fancy Bear is APT28, and they are different organizations answering to different halves of the Russian state. Mixing them up is the most common way readers draw the wrong conclusion about who was behind a given intrusion.
Sources
- Microsoft Learn, How Microsoft names threat actors (page updated October 22, 2026)
- Microsoft Threat Intelligence, CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft (July 31, 2026, updated October 5, 2026)
- CISA, NSA, FBI and international partners, joint advisory AA24-057A, SVR Cyber Actors Adapt Tactics for Initial Cloud Access (February 26, 2024)
- Microsoft Threat Intelligence, Midnight Blizzard: Guidance for responders on nation-state attack (January 25, 2024, updated February 13, 2024)
- CISA, FBI, NSA and international partners, joint advisory AA23-347A, Russian Foreign Intelligence Service (SVR) Exploiting JetBrains TeamCity CVE Globally (December 13, 2023)
- CISA, Russia State-Sponsored Cyber Threat: Advisories (index page, newest entry released July 23, 2026)
Published: October 26, 2026